Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

published 2026-04-10 6 mo ago modified 2026-10-25 14 d ago also GHSA-68qg-g8mg-6pr7 , EUVD-2026-25166

cvss: 10.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 31.7%; EPSS 31.7% chance of exploitation in 30 days, percentile 98%
public exploits: 1; Metasploit, plus a Nuclei check

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authenticated` mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default deployment configuration. Version 2026.416.0 patches the issue.

Patch / fix

fixed in 4

npm paperclipai 2026.410.0
npm @paperclipai/server 2026.410.0
paperclip paperclipai 2026.416.0
paperclip paperclipai/server 2026.416.0

Timeline

2026-04-10 First public exploit (Metasploit exploit/linux/http/paperclipai_unauth_rce_cve_2026_41679)
2026-04-10 Published

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: total
Assessed: 6 mo ago (2026-04-23)

Exploit prediction

31.67% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/linux/http/paperclipai_unauth_rce_cve_2026_41679 Paperclip AI RCE using a chain of six API calls (CVE-2026-41679). metasploit exploit, excellent rank, 2026-04-10
Nuclei template Paperclip - Remote Code Execution nuclei detection template
github.com https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
GitHub	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	paperclipai	<2026.410.0	2026.410.0
npm	@paperclipai/server	<2026.410.0	2026.410.0

Affected products

paperclipai paperclip
paperclipai @paperclipai/server

Classification

Weakness

CWE-287 Improper Authentication
CWE-862 Missing Authorization
CWE-1188 Initialization of a Resource with an Insecure Default

References

github.com /paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7
exploit, web, mitigation, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2026-41679
advisory
github.com /paperclipai/paperclip
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary